' +
+ '
Tor IBD Service Advertising
' +
+ '
' + escHtml(optionFeat.description || "") + '
' +
+ detailsHtml +
+ '
' +
+ 'Tor-only: This setting advertises the onion service. It does not open a clearnet port, expose your home IP address, or require router port forwarding.' +
+ '
' +
+ '
' +
+ '' + escHtml(optionStatusLabel) + ' ' +
+ '' + escHtml(optionButtonLabel) + ' ' +
+ '
' +
+ '
' +
'
Troubleshooting
' +
@@ -978,6 +1026,18 @@ async function openServiceDetailModal(unit, name, icon) {
}
}
+ var relatedFeatureButtons = $credsBody.querySelectorAll(".svc-detail-related-feature-btn");
+ relatedFeatureButtons.forEach(function(button) {
+ button.addEventListener("click", function() {
+ if (button.disabled) return;
+ var featureId = button.getAttribute("data-feature-id");
+ var relatedFeat = relatedFeatures.find(function(f) { return f.id === featureId; });
+ if (!relatedFeat) return;
+ closeCredsModal();
+ handleFeatureToggle(relatedFeat, !relatedFeat.enabled);
+ });
+ });
+
var restartBtn = document.getElementById("svc-detail-restart-btn");
var restartResult = document.getElementById("svc-detail-restart-result");
if (restartBtn && restartResult) {
diff --git a/modules/bitcoinecosystem.nix b/modules/bitcoinecosystem.nix
index a48047b..136fdf9 100755
--- a/modules/bitcoinecosystem.nix
+++ b/modules/bitcoinecosystem.nix
@@ -4,6 +4,11 @@ lib.mkIf config.sovran_systemsOS.services.bitcoin {
services.bitcoind = {
enable = true;
+ # Keep the normal loopback P2P socket available for local clients such as
+ # Bisq. Because `address` defaults to 127.0.0.1 this does not expose a
+ # clearnet or LAN listener. When the existing bitcoind onion service is
+ # enabled, this also creates its Tor-tagged loopback target on port 8334.
+ listen = true;
package = pkgs.bitcoind;
dataDir = "/run/media/Second_Drive/BTCEcoandBackup/Bitcoin_Node";
txindex = true;
@@ -16,7 +21,13 @@ lib.mkIf config.sovran_systemsOS.services.bitcoin {
'';
};
- nix-bitcoin.onionServices.bitcoind.enable = true;
+ nix-bitcoin.onionServices.bitcoind = {
+ enable = true;
+ # This is a locally vendored option namespace, not an upstream dependency.
+ # The onion listener remains available to peers that already know it;
+ # advertising its address through Bitcoin peer gossip is opt-in in the Hub.
+ public = config.sovran_systemsOS.features.bitcoin-tor-gossip;
+ };
nix-bitcoin.onionServices.electrs.enable = true;
nix-bitcoin.onionServices.rtl.enable = true;
diff --git a/modules/core/role-logic.nix b/modules/core/role-logic.nix
index b7d0331..499b382 100755
--- a/modules/core/role-logic.nix
+++ b/modules/core/role-logic.nix
@@ -33,6 +33,7 @@
haven = lib.mkForce false;
mempool = lib.mkForce false;
element-calling = lib.mkForce false;
+ bitcoin-tor-gossip = lib.mkForce false;
"nwc-wallets" = lib.mkForce false;
};
diff --git a/modules/core/roles.nix b/modules/core/roles.nix
index b35080f..bd180e5 100755
--- a/modules/core/roles.nix
+++ b/modules/core/roles.nix
@@ -45,6 +45,7 @@
haven = lib.mkEnableOption "Haven NOSTR relay";
mempool = lib.mkEnableOption "Bitcoin Mempool Explorer";
element-calling = lib.mkEnableOption "Element Video and Audio Calling";
+ bitcoin-tor-gossip = lib.mkEnableOption "Advertise the Bitcoin Core onion service through Bitcoin peer gossip";
# Compatibility shim for Hub-managed settings from releases where Core
# was an optional replacement for the default node. Core is now always
# selected when the Bitcoin service is enabled.
diff --git a/modules/core/sovran-hub.nix b/modules/core/sovran-hub.nix
index dec3eb5..98098fd 100644
--- a/modules/core/sovran-hub.nix
+++ b/modules/core/sovran-hub.nix
@@ -40,7 +40,7 @@ let
# ── Bitcoin Base ────────────────────────────────────────────
++ lib.optionals cfg.services.bitcoin [
{ name = "Bitcoin Core"; unit = "bitcoind.service"; type = "system"; icon = "bitcoin-core"; enabled = cfg.services.bitcoin; category = "bitcoin-base"; credentials = [
- { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/bitcoind/hostname"; prefix = "http://"; }
+ { label = "Tor Bitcoin P2P Address — Reachable only through Tor"; file = "/var/lib/tor/onion/bitcoind/hostname"; suffix = ":8333"; }
]; }
]
# ── Bitcoin Apps (services on top of the node) ─────────────
@@ -122,6 +122,9 @@ let
role = activeRole;
services = monitoredServices;
feature_manager = true;
+ feature_states = {
+ bitcoin-tor-gossip = cfg.features.bitcoin-tor-gossip;
+ };
sovran_version = sovranVersion;
});
diff --git a/tests/test_bitcoin_tor_gossip.py b/tests/test_bitcoin_tor_gossip.py
new file mode 100644
index 0000000..8308ebb
--- /dev/null
+++ b/tests/test_bitcoin_tor_gossip.py
@@ -0,0 +1,78 @@
+"""Regression tests for the Bitcoin Core Tor IBD gossip Hub option.
+
+These tests intentionally avoid importing the FastAPI application so they can run
+in the repository's lightweight test environment without NixOS service access.
+"""
+
+import ast
+import os
+import unittest
+
+
+_REPO_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
+
+
+def _read(*parts: str) -> str:
+ with open(os.path.join(_REPO_ROOT, *parts), encoding="utf-8") as source:
+ return source.read()
+
+
+def _literal_assignment(source: str, name: str):
+ tree = ast.parse(source)
+ for node in tree.body:
+ if isinstance(node, ast.Assign):
+ if any(isinstance(target, ast.Name) and target.id == name for target in node.targets):
+ return ast.literal_eval(node.value)
+ raise AssertionError(f"Assignment {name} was not found")
+
+
+class TestBitcoinTorGossipNixWiring(unittest.TestCase):
+ def test_bitcoind_loopback_listener_is_always_enabled(self):
+ ecosystem = _read("modules", "bitcoinecosystem.nix")
+ self.assertIn("listen = true;", ecosystem)
+ self.assertIn("peerbloomfilters=1", ecosystem)
+
+ def test_gossip_is_opt_in(self):
+ ecosystem = _read("modules", "bitcoinecosystem.nix")
+ self.assertIn(
+ "public = config.sovran_systemsOS.features.bitcoin-tor-gossip;",
+ ecosystem,
+ )
+
+ def test_hub_option_and_evaluated_state_are_declared(self):
+ roles = _read("modules", "core", "roles.nix")
+ hub = _read("modules", "core", "sovran-hub.nix")
+ self.assertIn("bitcoin-tor-gossip = lib.mkEnableOption", roles)
+ self.assertIn("bitcoin-tor-gossip = cfg.features.bitcoin-tor-gossip;", hub)
+
+
+class TestBitcoinTorGossipHubWiring(unittest.TestCase):
+ @classmethod
+ def setUpClass(cls):
+ cls.server_source = _read("app", "sovran_systemsos_web", "server.py")
+ cls.registry = _literal_assignment(cls.server_source, "FEATURE_REGISTRY")
+
+ def test_feature_is_modal_only_and_explains_risk(self):
+ feature = next(item for item in self.registry if item["id"] == "bitcoin-tor-gossip")
+ self.assertTrue(feature["modal_only"])
+ self.assertIn("bitcoin-service", feature["requires"])
+ self.assertTrue(any("clearnet" in detail for detail in feature["details"]))
+ self.assertTrue(any("bandwidth" in detail for detail in feature["details"]))
+
+ def test_backend_rejects_gossip_without_bitcoin_service(self):
+ self.assertIn(
+ "Enable the Bitcoin service before advertising its Tor IBD service.",
+ self.server_source,
+ )
+
+ def test_core_modal_renders_and_controls_the_option(self):
+ frontend = _read(
+ "app", "sovran_systemsos_web", "static", "js", "service-detail.js"
+ )
+ self.assertIn("Tor IBD Service Advertising", frontend)
+ self.assertIn("svc-detail-related-feature-btn", frontend)
+ self.assertIn("handleFeatureToggle(relatedFeat", frontend)
+
+
+if __name__ == "__main__":
+ unittest.main()